Core Lightning Warns Node Operators After AI-Driven Bug Reports
The warning applies to operators of Lightning nodes that process BTC payments; Core Lightning will first roll out a fixed, signed release.
Key Takeaways
- Core Lightning is warning node operators after several real vulnerabilities came to light from AI-generated bug reports.
- Users should not shut down nodes for now; anyone who cannot update should restart in offline mode.
- The details will stay secret for two weeks, while Core Lightning 26.09 with fixes is planned for late September.
Core Lightning has urgently warned node operators after a wave of AI-generated bug reports uncovered several real vulnerabilities. The software, which is used to send bitcoin over the Lightning Network, should not be shut down for now, according to the developers. Anyone who cannot update right away should restart the node in offline mode so it keeps running and can keep monitoring BTC in payment channels.
Why Offline Mode Matters
The Lightning Network sits on top of Bitcoin and makes fast, cheap BTC payments possible without putting every single payment on the blockchain. Core Lightning, also known as CLN, is one of the main software packages used to run those nodes and route payments.
According to the team, the small development group started receiving a large number of AI-generated reports in early August. These reports point to possible weak spots, after which developers have to figure out whether a problem can actually be exploited. In this case, several reports turned out to be valid. The details will remain private for two weeks while a version with fixes is being prepared. After that, the project wants to make the source code and the vulnerabilities public.
What Operators Need to Do Now
The first instruction spread quickly on Bitcoin social media, but it also got passed along incorrectly along the way. The main point stayed the same: do not turn off the machine. A node that is fully shut down can no longer see whether a counterparty is trying to use an old balance when closing a payment channel. By starting Core Lightning with --offline, the processes keep running and the node keeps following the Bitcoin blockchain, while no new payments are sent, received, or routed.
Core Lightning wants to release signed versions of the patch first, so operators can verify that the files really came from the development team. The planned release of Core Lightning 26.09 is still on the calendar for late September, although the project has not said exactly which vulnerabilities were found or whether anyone has already exploited them.
Second Security Alert This Month
For Bitcoin infrastructure, this is another tense month. In early August, a bug in BTCPay Server exposed login credentials from Lightning nodes, after which attackers drained funds from some nodes before a fix was available. AI also played a role in that security debate, because developers said the balance between attackers and defenders is shifting.
The broader context is that open-source maintenance teams are being flooded more and more often by AI-generated reports, making it harder to quickly separate real problems from noise. At the same time, a recent AI audit by the Bitcoin Red Team shows how much code there is to review in the Bitcoin world: the group scanned 390 projects and found 4,962 issues, including 85 critical ones. For European crypto readers, that matters because a lot of BTC infrastructure runs on open-source software that directly affects the security of payments and custody.
Other Bitcoin infrastructure also had to deal with an emergency call this year. In a critical BTCPay flaw, operators had to take their servers offline or update immediately after attackers were able to siphon funds through Lightning nodes.
